kosmos_encfs
Install encfs and set up encryption for a data directory.
Provisioning a new machine
Add encfs to the run list and run chef before adding other cookbooks that depends on the encfs mount.
Log into the system and create the data directory like so:
encfs /usr/local/lib/encrypted_data /mnt/data --public
When asked for config options, choose nothing (i.e. "standard"). Do NOT choose paranoia mode, as it breaks some software, like e.g. PostgreSQL.